CVE-2022-33941: Improper Neutralization of Special Elements used in an OS Command

PowerCMS XMLRPC API provided by Alfasado Inc. contains a command injection vulnerability. Sending a specially crafted message by POST method to PowerCMS XMLRPC API may allow arbitrary Perl script execution, and an arbitrary OS command may be executed through it. Affected products/versions are as...

Amazon Linux 2022 : xmlrpc-c, xmlrpc-c-apps, xmlrpc-c-c++ (ALAS2022-2022-080)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-080 advisory. A flaw was found in expat. Passing malformed 2- and 3-byte UTF-8 sequences for example, from start tag names to the XML processing application on top of expat can lead to arbitrary code execution. This...

PowerCMS XMLRPC API vulnerable to command injection

Overview PowerCMS XMLRPC API provided by Alfasado Inc. contains a command injection vulnerability CWE-74. Sending a specially crafted message by POST method to PowerCMS XMLRPC API may allow arbitrary Perl script execution, and an arbitrary OS command may be executed through it. According to the...

CVE-2022-38078

Movable Type XMLRPC API provided by Six Apart Ltd. contains a command injection vulnerability. Sending a specially crafted message by POST method to Movable Type XMLRPC API may allow arbitrary Perl script execution, and an arbitrary OS command may be executed through it. Affected products and...

CVE-2022-38078

Movable Type XMLRPC API provided by Six Apart Ltd. contains a command injection vulnerability. Sending a specially crafted message by POST method to Movable Type XMLRPC API may allow arbitrary Perl script execution, and an arbitrary OS command may be executed through it. Affected products and...

Command injection

Movable Type XMLRPC API provided by Six Apart Ltd. contains a command injection vulnerability. Sending a specially crafted message by POST method to Movable Type XMLRPC API may allow arbitrary Perl script execution, and an arbitrary OS command may be executed through it. Affected products and...

CVE-2022-38078

Movable Type XMLRPC API provided by Six Apart Ltd. contains a command injection vulnerability. Sending a specially crafted message by POST method to Movable Type XMLRPC API may allow arbitrary Perl script execution, and an arbitrary OS command may be executed through it. Affected products and...

CVE-2022-38078

Movable Type XMLRPC API provided by Six Apart Ltd. contains a command injection vulnerability. Sending a specially crafted message by POST method to Movable Type XMLRPC API may allow arbitrary Perl script execution, and an arbitrary OS command may be executed through it. Affected products and...

CVE-2022-38078

CVE-2022-38078 affects Movable Type XMLRPC API. A POST request to the XMLRPC endpoint can execute arbitrary Perl scripts and OS commands due to a command-injection flaw in MT/MT Advanced/MT Premium lines (versions 7 r.5202 and earlier; 6.8.6 and earlier; 1.52 and earlier). All MT 4.0+ EOL version...

CVE-2022-38078: Improper Control of Generation of Code

Movable Type XMLRPC API provided by Six Apart Ltd. contains a command injection vulnerability. Sending a specially crafted message by POST method to Movable Type XMLRPC API may allow arbitrary Perl script execution, and an arbitrary OS command may be executed through it. Affected products and...

PT-2022-4446 · Unknown · Movable Type Premium Advanced +3

Name of the Vulnerable Software and Affected Versions: Movable Type versions 4.0 and later Movable Type versions 7 r.5202 and earlier Movable Type Advanced versions 7 r.5202 and earlier Movable Type versions 6.8.6 and earlier Movable Type Advanced versions 6.8.6 and earlier Movable Type Premium...

PT-2022-4859 · Zoho · Zoho Manageengine Pam360 +2

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine Password Manager Pro versions prior to 12101 Zoho ManageEngine PAM360 versions prior to 5510 Zoho ManageEngine Access Manager Plus versions prior to 4303 Description: The issue is related to a deserialization mechanism flaw ...

Amazon Linux 2 : xmlrpc-c (ALAS-2022-1795)

The version of xmlrpc-c installed on the remote host is prior to 1.32.5-1905.svn2451. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2022-1795 advisory. A flaw was found in expat. Passing malformed 2- and 3-byte UTF-8 sequences for example, from start tag names to the XM...

Amazon Linux AMI : xmlrpc-c (ALAS-2022-1585)

The version of xmlrpc-c installed on the remote host is prior to 1.22.04-r1934.7. It is, therefore, affected by a vulnerability as referenced in the ALAS-2022-1585 advisory. A flaw was found in expat. Passing malformed 2- and 3-byte UTF-8 sequences for example, from start tag names to the XML...

Critical: xmlrpc-c

Issue Overview: A flaw was found in expat. Passing malformed 2- and 3-byte UTF-8 sequences for example, from start tag names to the XML processing application on top of expat can lead to arbitrary code execution. This issue is dependent on how invalid UTF-8 is handled inside the XML processor...

Critical: xmlrpc-c

Issue Overview: A flaw was found in expat. Passing malformed 2- and 3-byte UTF-8 sequences for example, from start tag names to the XML processing application on top of expat can lead to arbitrary code execution. This issue is dependent on how invalid UTF-8 is handled inside the XML processor...

Yelp: xmlrpc file enabled

Summary: Hello team, I have found a security vulnerability in restaurants.yelp.com/xmlrpc.php which lets attacker to: 1: XSPA or PortScan 2: Bruteforce 3:DOS and much more Platforms Affected: https://restaurants.yelp.com Steps To Reproduce: 1: Go to https://restaurants.yelp.com/xmlrpc.php to chec...

Mageia: Security Advisory (MGASA-2022-0183)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

new packages: xmlrpc-c

An update is available for xmlrpc-c. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky Linux 9.0...

GHSA-G34C-MG6M-XVXJ Cobbler subject to Command Injection

A Command Injection in actionpower.py in Cobbler prior to v2.6.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the 1 username or 2 password fields to the powersystem method in the xmlrpc API...